Anomalous Bun Runtime Download via Node
Detects the anomalous download of the Bun JavaScript runtime during npm/node-gyp installation phases. The Miasma malware uses a standalone Bun runtime to execute its obfuscated payloads outside of standard Node.js security tooling contexts to evade monitoring.
Sigma
